We recommend that the Director of CPD’s Office of Disaster Recovery make changes to the action plan process so that the action plan calculates an overall LMI percentage.

PIH in coordination with other HUD offices as necessary, research and address potential causes of the variance in the number of EBLL cases among States on the EBLL tracker and identify solutions that are within HUD's control.

Status

On May 7, 2024, the Office of Field Operations (OFO) stated that it met with the Real Estate Assessment Center (REAC) and Office of Lead Hazard Control and Healthy Homes (OLHCHH) on March 4 and April 23 and agreed that OFO and OLHCHH will review CDC data on counties with the highest prevalence of EBLLs in children for counties whose states that have reported their BLL data to CDC. OFO will review its EBLL tracker to determine reporting rates by the largest public housing authorities in those counties. OLHCHH will assign an analyst to summarize the most recently available prevalence rates based on selected states. Subsequently, OFO will scrutinize public housing authorities within those states to ascertain the reported cases.

The revised estimated completion date is February 28, 2025.

Analysis

To fully address this recommendation, OFO must provide evidence of meetings held and summaries of the research conducted. For example, what was the exchange with OLHCHH, did OFO coordinate with any other offices, and what research was conducted? OFO needs to research potential causes for the variances and determine what HUD could do to address them.

Alternatively, OFO must establish that there are no solutions within HUD’s control to address any identified causes.

Implementation of this recommendation will help ensure that EBLL cases are reported and recorded appropriately in the EBLL tracker.

Update HUD regulations, policies, and procedures following the regulatory process required by the amended Lead Safe Housing Rule, in consideration of CDC’s lowered BLRV of 3.5 ug/dL.

Status

On June 12, 2024, the Office of Lead Hazard Control and Healthy Homes informed HUD OIG that the draft Federal Register notice of its request for information from Lead Safe Housing Rule stakeholders and the general public on its proposal to adopt CDC's BLRV of 3.5 µg/dL as its EBLL under the rule has been circulated for OGC and preclearance review, which will be followed by Departmental clearance. OLHCHH plans on publishing the Federal Register notice by June 30, 2024, with a 60-day comment period. OLHCHH will provide the link and the link and the notice once it is published. OLHCHH will then review public comments in preparing to decide whether to change the rule's current level, and if so, to what level.

The Office of Lead Hazard Control and Healthy Homes estimated this will be completed by June 30, 2024.

Analysis

To fully address this recommendation, OLHCHH must provide evidence that it has updated its regulations, policies, and procedures so that they are consistent with CDC’s lowered BLRV of 3.5 ug/dL.

Alternatively, OLHCHH must establish that its research led it to determine that environmental interventions in cases of children with EBLLs between 3.5 and 4.9 µg/dL were ineffective in reducing the children’s blood lead levels and that lowering HUD’s EBLL regulation to 3.5 µg/dL is unnecessary.

Implementation of this recommendation will help ensure children living in public housing with EBLLs receive effective environmental interventions.

Identify short- and long-term plans for the RPA program that align its capabilities, staffing needs, funding projections, and mission needs.

Implement procedures to capture and monitor centralized logs to maintain appropriate visibility into bot activities and provide for auditability of bot actions.

Implement procedures to periodically review RPA system access and remove access for users that are not authorized or no longer have a need to use the system.

Implement procedures to ensure that attended bots use the security rights and credentials of the attending user.

Assess its help desk system against other technical solutions and ensure that the help desk solution used captures complete data on technical support requests. This measure includes but is not limited to ensuring that sequence gaps are properly documented or do not occur, valid transactions are accepted by the help desk system, rejected transactions are identified, and the history of each transaction is retained.

Perform a complete agency-wide fraud risk assessment (which incorporates the fraud risk assessments performed at the program level) and use the results to develop and implement an agency-wide plan to move HUD’s fraud risk management program out of the ad hoc phase.

Status

HUD continues to make progress in advancing HUD’s Fraud Risk Management program. HUD issued its Fraud Risk Policy on March 31, 2022. Since then, HUD has integrated fraud risk considerations into risk assessment work completed across HUD, to include processes for Front End Risk Assessments (FERA) and the annual risk profile refresh. Leveraging the history of reports issued by HUD oversight partners, HUD has (1) compiled program level oversight reports to identify fraud risk concerns; (2) initiated a repository to stratify elements of the reports to isolate fraud risk concerns; and (3) isolated trends and themes from the source reports. This baseline work will support the Department’s Fraud Risk Exposure report, due September 2024.

The Chief Risk Officer (CRO) has indicated that it is nearing completion on an entity wide fraud risk exposure analysis. This analysis will tell HUD what programs should be prioritized and reviewed regularly, and which programs can be reviewed less frequently. The programs ranked highest will be first on the list for a full fraud risk assessment and the CRO will lay out a plan and timeline for completing the others. The CRO is also working on a plan to transition from the use of contractor support to full time staff, the plan will occur in phases until 2027, with the first hiring actions occurring soon. The Office of Multifamily Housing (MFH) met with OIG on April 7 to demonstrate the progress they have made on their program-specific fraud risk assessment for the Project Based Rental Assistance Program. MFH expects to complete the assessment by July 15th. the Offices of Public and Indian Housing and Community and Planning and Development have not completed fraud risk assessments, but are working on assigning or hiring staff for dedicated risk management roles.

Analysis

While HUD has made considerable progress in the area of fraud risk management, there is still a lot of work to be done for HUD to complete an entity wide fraud risk assessment. While HUD's exposure analysis will help it to determine where to focus its efforts, HUD still needs to conduct program specific fraud risk assessments. Based on the demonstration by MFH, we believe that MFH has made great progress in its fraud risk assessment and we are encouraged that it has identified areas of weakness that it plans to target. However, PIH and CPD have not been able to demonstrate progress in this area and we do not believe that they will be able to complete program specific fraud risk assessments by 9/30/24.

To fully address this recommendation, HUD must provide evidence that it has performed an agency-wide fraud risk assessment performed at the program level, adopted and implemented its fraud risk assessment program departmental policy and that each HUD program office has established office-specific risk programs/p>

Develop and implement a strategy for collecting and analyzing agency-wide data, to include subrecipient and beneficiary data, to identify trends and potential indicators of fraud across programs.

In conjunction with corrective actions being taken on previous audits, revise ONAP’s internal policy and procedures to include detailed written policies and procedures for the marketing, preservation, and sale of defaulted loan notes and REO properties on tribal trust and other restricted lands.

Requires the REAC in coordination with OFO to determine the number of developments and associated units that contain lead-based paint and lead-based paint hazards.

Status

The Real Estate Assessment Center and Office of Field Operations will collaborate with the Office of Lead Hazard Control and Healthy Homes, the Office of Policy Development and Research, and a statistician to evaluate data collected under the NSPIRE inspection program to estimate the number of public housing developments and associated units that contain lead-based paint and lead-based paint hazards. The final action target date is March 31, 2025.

Analysis

To address this recommendation, HUD will need to provide evidence that it collected and evaluated data under NSPIRE and estimated the number of public housing developments and associated units that contain lead-based paint and lead-based paint hazards.

Implementation of this recommendation will assist HUD in working with PHAs to address the public housing units that contain lead-based paint and lead-based paint hazards and help HUD’s oversight of units in need of hazard reduction.

We recommend that the General Deputy Assistant Secretary for Public and Indian Housing require the Real Estate Assessment Center in coordination with the Office of Field Operations to determine the cost to eliminate or control the lead-based paint and lead based paint hazards in public housing and the timeframe to complete such work based on the existing funding levels and strategies that could accelerate the timeframe.

We recommend that the General Deputy Assistant Secretary for Public and Indian Housing require the Real Estate Assessment Center in coordination with the Office of Field Operations to determine whether the public housing agencies identified as having lead-based paint hazards in their housing developments maintain and implement a plan for managing lead-based paint. For any public housing agency that does not have a plan for the management of lead-based paint in its public housing developments, as appropriate, HUD should inform the public housing agency that it should develop and implement its own plan.

We recommend that the General Deputy Assistant Secretary for Public and Indian Housing require the Real Estate Assessment Center in coordination with the Office of Field Operations to assess the lead-based paint hazard reduction activities performed at the 19 developments associated with 18 public housing agencies reviewed that did not implement interim controls and ongoing maintenance and reevaluation activities or adequately document that previously identified lead-based paint had been abated or treated with interim controls and subjected to ongoing maintenance and reevaluation activities. If those reduction activities did not fully abate the lead-based paint, HUD should ensure that the public housing agencies implement interim controls and ongoing maintenance and reevaluation programs and maintain required documentation.

Update applicable requirements to require assisted property owners, including PHAs, to maintain adequate documentation to support their determinations that maintenance and hazard reduction activities that disturb surfaces with lead-based paint qualify for the de minimis exemption from the lead-safe work practices under the Lead Safe Housing Rule.

Status

The Office of Lead Hazard Control and Healthy Homes has drafted guidance on the de minimis exception to the Lead Safe Housing Rule for the Office of Public and Indian Housing, the Office of Multifamily Housing, and the Office of Community Planning and Development.

The Office of Lead Hazard Control and Healthy Homes expects to issue the guidance in final by July 2024.

Analysis

To implement this recommendation, HUD needs to provide evidence that it has prepared and issued a notice to target housing owners and public housing agencies on the de minimis exception and conducted trainings/webinars on requirements and best practices pertaining to de minimis.

Implementation of this recommendation and associated corrective actions will ensure assisted property owners are sufficiently informed regarding the requirements to support their determinations that maintenance and hazard reduction activities that disturb surfaces with lead-based paint qualify for the de minimis exemption from the lead safe work practices under the Lead Safe Housing Rule and that assisted property owners are conducting this work safely, thereby ensuring households are residing in safe and healthy HUD assisted housing.

HUD OCIO should implement procedures to ensure that information in cybersecurity risk registers is obtained accurately, consistently, and in a reproducible format and is used to a. quantify and aggregate security risks, b. normalize cybersecurity risk information across organizational units, and c. prioritize operational risk response (derived from metric 5).

HUD OCIO and the HUD Chief Risk Officer should coordinate to implement procedures to monitor the effectiveness of cybersecurity risk responses to ensure that risk tolerances are maintained at an appropriate level (derived from metric 5).

HUD OCIO and the Office of Administration should implement procedures to ensure proper validation of media sanitization in accordance with HUD Media Protection Procedures 2.0 (February 2022) and form HUD 1067A, Certification of Sanitization (derived from metric 36).

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.